Embedding Similarity: We also measure the cosine similarity between adversarial description and the corresponding original description using sentence embeddings derived from pretrained model BERT [1]}. The sentence embeddings are derived from a Siamese network trained using triplet loss [2]}. We convert the similarity value into a distance value by subtracting it by 1 (hereafter, `BERT'). We keep the embedding length as 768. Table REF  (column 7) reiterate the distance-based observations. Note that, as contextual embeddings successfully capture voice-related changes, the adversarial class VoC also shows low perturbation distance.
